Threat Brief — 2026-08-25 — Six New KEV Entries Demand Immediate Patching

CISA pushed six new actively-exploited vulnerabilities into its KEV catalog today, headlined by a Microsoft IKE Service double-free (CVE-2026-33824KEV) and a Gitea code-injection flaw that lets repo collaborators achieve RCE via malicious Git patches. The remaining four KEV additions span Oracle, Zimbra, and three other products—several with public exploit status. CISA also released a joint red-team SOC assessment advisory offering practical defensive lessons.

Top Items

• CISA KEV: Four new exploited CVEs including Microsoft IKE double-free. CISA added CVE-2026-33824KEV (Microsoft Internet Key Exchange Service Extensions double-free), CVE-2026-55040KEV, CVE-2026-59310KEV·R, and CVE-2026-65400KEV to the Known Exploited Vulnerabilities catalog—all confirmed exploited in the wild. Patching deadlines apply; Microsoft IKE exposure is particularly broad given its ubiquity in Windows Server remote-access scenarios. (src: CISA Current Activity)

• CISA KEV: Gitea code injection (CVE-2026-60004KEV) actively exploited. An attacker with repository write access can send a malicious patch to the diffpatch API endpoint, plant an executable Git hook, and execute shell commands on the Gitea server. This is now known-exploited in the wild per CISA KEV. Any self-hosted Gitea instance with collaborator access models is at risk—restrict write permissions and update immediately. (src: CISA KEV)

• CISA advisory: "A Tale of Two SOCs" red-team insights. CISA co-authored an advisory (AA26-237A) comparing two red-team assessments against different SOC environments, detailing detection gaps, response timelines, and practical improvements. Worth circulating to blue-team leads for benchmarking defensive posture against realistic adversary tradecraft. (src: CISA Cybersecurity Advisories)

• Dirty Cow exploit analysis: practical root via in-memory code. A technical deep-dive examines why working Dirty COW PoCs don't always yield root and how to adapt exploits for BusyBox, vDSO, and specific Linux environments. While Dirty COW itself is old, the analysis highlights that unpatched embedded and legacy Linux systems remain viable targets—useful for assessing residual risk in IoT/OT estates. (src: SecurityLab.ru)

Themes

KEV acceleration: CISA added six CVEs in a single day, continuing an aggressive KEV expansion pattern. Teams should automate KEV feed ingestion against asset inventories rather than relying on periodic reviews. The Gitea and Microsoft IKE entries both represent broad attack surfaces where exploitation doesn't require privileged starting access.

Identity-adjacent attack surface: A separate industry analysis highlights that attackers are shifting from credential theft to targeting identity-verification and account-recovery workflows—bypassing MFA entirely by exploiting the processes that gate it. This aligns with the broader trend of social-engineering-driven breaches seen across recent healthcare and corporate incidents.